Using The Count(*) Clause; Using The Distinct Clause; Using The Count (Distinct - Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - AQL EVENT AND FLOW QUERY CLI GUIDE Manual

12 U AQL Q
SING THE
Using the Count(*)
Clause
Using the Distinct
Clause
Using the Count
(Distinct ...) Clause
CLI
UERY
For example:
select sourceBytes, sourceIP from flows where sourceBytes >
1000000 order by sourceBytes
Or, if you wish to display results in ascending order:
select sourceBytes, sourceIP from flows where sourceBytes >
1000000 order by sourceBytes asc
Combing the
group by
creating data, such as, TopN lists to determine the most abnormal events or the
most bandwidth intensive IP addresses. For example, the following query displays
the top traffic intensive IP address in a descending order:
select sourceIP, sum(sourceBytes) from flows group by sourceIP
order by sum(sourceBytes) desc
You can use the
count(*)
query. For example, if you wish to count all events with credibility equal to or
greater than 9:
select count(*) from events where credibility >= 9
You can use the
distinct
group of columns. This clause is similar to the
clause ensure ANSI SQL compatipility. For example:
distinct
select distinct sourceIP, sourcePort from flows where
sourceBytes > 1000000
You can use the standard
counts. Using the AQL CLI, you can only use one field. For example, if you wish to
view all the IP addresses that are connected to a specific IP address over time:
select count(distinct sourceIP) from flows where destinationIP =
'192.168.61.71'
Or, if you wish to view the number of unique source IP addresses communicating
with a particular destination IP address:
select destinationIP, count(distinct sourceIP) from flows group
by destinationIP
Note: Using this clause may require additional system resources. Therefore,
depending on the query, the amount of time to return results may vary.
AQL Event and Flow Query CLI Guide
and the clauses in a single query is useful for
order by
clause to count the number of records matching your
clause to select unique rows based on a column or a
SQL Count(Distinct ...)
clause, however, the
group by
clause to obtain unique